Daily snacks

Your agents’ session history can now live on your own server. Claude Platform’s Nov 12, 2026 release notes launch self-hosted Claude Managed Agents, where you run the whole service and not only the sandboxes. Access goes through the Anthropic account team and isn’t self-serve.

Send your Bot to the meeting and read the recap later. On Team, Enterprise and Ultra plans, Grok Bot’s Nov 11, 2026 update lets a Bot join a Google Meet, Zoom or Microsoft Teams call from a link, answer in the meeting chat and send a summary afterward.

Dependabot alerts go quiet on repos with no activity for a year, starting Dec 8, 2026. GitHub announced the change on Nov 10, 2026, and says existing alerts are archived, not deleted.

Google’s Gemini 4 Carbon just landed in Copilot’s model picker. GitHub announced on Nov 10, 2026 that it is generally available, with a rollout that is gradual.

A key that slips into a build log can now raise a secret scanning alert. GitHub announced on Nov 9, 2026 that secret scanning covers GitHub Actions workflow logs, in public preview.

Claude Fable 5.2 is now in your Copilot model picker, if your plan and admin allow it. GitHub made it generally available on Nov 9, 2026, for complex, multistep coding tasks across large codebases.

Check your project’s .claude/settings.local.json for passwords and keys. As reported by The Hacker News, Apiiro found 1,122 public copies of that file on GitHub holding at least one secret, saved by “Yes, and don’t ask again” approvals.

GPT-6 Cyber is OpenAI’s new model for authorized security research. The Nov 5, 2026 post says it finds and validates exploitable vulnerabilities, helps develop fixes, and is trained to stay inside the scope researchers set. It starts on the API and Codex for a select group of Daybreak Red customers.

Your cloud agent can now leave localhost with a shareable live app. Cursor’s Nov 5, 2026 changelog says you describe the app, and it scaffolds the code, can provision Postgres, puts auth behind Cursor sign-in, and hosts it after you publish.

A leaked Claude API key now has fewer places it can run. Claude Platform’s Nov 5, 2026 release notes add organization IP allowlists in beta, so covered requests from addresses outside your list are refused. You can add up to 1,000 IPv4 or IPv6 addresses or CIDR ranges.

Images 2.6 brings GIFs, SVG, and faster turns to Codex. OpenAI’s Nov 4, 2026 post also puts the release in ChatGPT and the API, with generation about 50% faster than before and GPT-Image-2.6 Flare and Sunburst for developers.

Action needed: the legacy GitHub app in Microsoft Teams retires on Nov 16, 2026. GitHub announced this on Oct 23, 2026. Install the consolidated GitHub app (formerly GitHub notifications) so @GitHub and Copilot in Teams keep working.

GitHub Copilot now sits inside Xcode’s built-in coding assistant. The public preview, announced Nov 4, 2026, starts with Xcode 27.3 beta, and the older Copilot for Xcode extension stays available as a separate path.

Your Copilot plan now doubles as an agent inside JetBrains Air. Since Nov 3, 2026, you can pick GitHub Copilot in Air’s agent picker, hand it coding tasks in your JetBrains IDE or in the cloud, and review the changes next to your code.

Your headless Claude Code jobs now get a heads-up before the stored sign-in runs out. The latest release adds a one-line warning to claude -p text output starting 10 days before a stored claude.ai sign-in ends, and shows the end date in claude auth status.

Action needed: Google deprecated gemini-2.5-pro and gemini-2.5-flash in the Gemini API on Nov 2, 2026. From Dec 1, 2026, requests to them go to newer models automatically and are billed at those models’ rates.

A scheduled task that quietly picks up connectors now gets called out. Claude Code’s latest release warns in /schedule when a new cloud scheduled task gets connectors you didn’t ask for, and shows how to remove them.

Long agent loops can stop re-uploading the whole conversation every turn. Message threads, in beta on the Claude Messages API since Nov 2, 2026, keep the conversation on the server so each later request carries only the new messages, with a lower time to first token.

Action needed: Claude Code deprecated fast mode for Opus 4.8 as of Oct 30, 2026, and removes it on Nov 30, 2026. After that, fast mode requests on Opus 4.8 return an error and don’t fall back to standard Opus 4.8.

Billing change: starting in December, Plus, Pro and Business plans get one usage allowance shared across ChatGPT and Codex. OpenAI’s Help Center page on the change went up on Oct 31, 2026, and says usage will be measured in tokens.

Keep Claude Code’s file edits inside your project folders. A new setting, permissions.blockWritesOutsideWorkingDirectories, makes the Write, Edit and NotebookEdit tools refuse paths outside your working directories. The release came out late on Oct 29, 2026.

Action needed: a tampered Claude Code extension in Cursor’s extension marketplace tries to plant an SSH backdoor. Cursor’s Oct 29, 2026 notice says versions 2.1.312 and 2.1.313 were not made by Anthropic and were live from about 5:27 a.m. to 4:35 p.m. ET that day.

If you installed or updated either in that window, check for the svc-telemetry key now.

Give Copilot a goal that spans repos — or your desktop.

The GitHub Copilot app’s Oct 28, 2026 Universe release puts Projects and computer use in public preview: Projects gather multi-repo or non-repo work in one place, and computer use (macOS and Windows) can click and type in desktop apps after you approve.

Billing change: GitHub Enterprise now includes Copilot for every licensed user. Announced Oct 28, 2026, it’s available now on GitHub Enterprise Cloud for enterprises that work with a GitHub or Microsoft account team, with AI usage metered from the first request against the enterprise budget.

Stop telling Copilot your test command every session. Copilot Memory became generally available on paid Copilot plans on Oct 28, 2026, so personal preferences and repository conventions carry across sessions and clients. Dreaming, now in public preview, keeps those memories current.

No more guessing which model fits the job. Fusion went generally available on Oct 28, 2026: select Fusion in the model picker, choose Standard, High or Max, and Copilot routes and orchestrates models for each prompt.

Your next GitHub Action can start as a Markdown file. Agentic Workflows went generally available on Oct 28, 2026. Describe issue triage, CI failure analysis, docs updates or test writing in natural-language Markdown, and they compile into standard Actions YAML.

Your Copilot SDK agents can stop riding on someone’s login. In public preview since Oct 27, 2026, a GitHub App installed on your organization can make Copilot requests for the org, with no signed-in user’s credentials. Usage is billed to the org.

Codex CLI now talks to Google Cloud on its own. The latest release adds a built-in Google Cloud Vertex AI provider, set with model_provider = "gcp", and puts GPT-6.1 Terra in the model catalogs.

Claude Code quietly shortens the prompt for custom model names. On Bedrock, Vertex, Foundry and Mantle, names it doesn’t recognize, even ones that point at Sonnet or Haiku, now get the shorter system prompt. Set CLAUDE_CODE_SIMPLE_SYSTEM_PROMPT=0 to keep the full prompt.

Action needed: the OpenCode GitHub Action is no longer published, and the release notes say to remove it from your workflows. The same release, out Oct 27, 2026, also moves the Promise API to the root of @opencode/ai and makes TUI plugins require OpenTUI 0.7.0.

Let Copilot run the clearly safe steps without asking. Assisted permissions are now generally available in Copilot CLI, the Copilot app and VS Code.

A language model checks each request to run a command, access a file path or open a URL, lets clearly safe ones proceed and asks you about the rest.

Update now: long Claude Code sessions stop dead-ending on a credits error. Standard-context sessions stopped with “Usage credits required for 1M context” when a request ran over 200K tokens. The release out Oct 26, 2026 compacts the conversation and keeps going instead.

Agent builders get a cheaper computer-use model: gpt-6.1-terra is in the OpenAI API at $1 per million input tokens, $0.05 cached and $5 output. OpenAI announced it on Oct 26, 2026, and says that’s 50% below GPT-5.6 Terra and GPT-6.1 Sol.

It’s also in ChatGPT Work and Codex for Plus, Pro, Enterprise and Edu users.

Read the full Main Course →

See every file your agent touched, right in Cline Desktop. A new Changes button opens a pane listing the files changed in the last turn or across the whole session, with a diff of each.

The update also adds a project file tree, a built-in terminal and a Local Models page for Ollama and LM Studio.

Check your model: Cline’s Oct 26, 2026 updates change default models again. ClinePass now defaults to Kimi K3.1 Pro, and most other providers get new defaults, mostly Kimi K3.1 Pro, MiniMax M3.1 Flash or DeepSeek V4.1 Flash 1017.

With no model chosen, the Cline provider uses Claude Sonnet 5.5 again.

Coding agent users, stop launching agents from Downloads: a planted AGENTS.md there told a real customer’s agent to install a malicious npm package. Forever Security caught the attempt and reproduced the attack on Codex and Claude Code.

There’s no patch coming, because the agents are doing what they were built to do.

Your agent can now sign in without seeing your password. On Oct 22, 2026, 1Password launched 1Password for Agents, with Grok Bot among the first integrations.

Your agent asks for one saved login, you approve it in 1Password, and 1Password fills it in, so the agent never sees the password or the one-time code.

Read the full Main Course →

Replit’s Monitoring Agent answers your app’s alarms for you. Launched on Oct 22, 2026, it can investigate a production issue, make and validate a fix and email you a summary of what happened.

Turn on Auto-republish and it can publish the fix too; leave it off to review the change first.

Read the full Main Course →

Your agent’s small decisions get a fast lane. OpenAI made the Decisions API generally available on Oct 22, 2026. Built with GPT-6 Luna, it handles questions with bounded answers, and OpenAI says it makes decisions up to 10x faster than GPT-6 Luna through the Responses API.

Input costs $0.10 per million tokens, and there are no output-token charges.

Action needed: Copilot features you left unconfigured will follow your global default. GitHub began rolling out enforcement of the global default policy for Copilot Business and Copilot Enterprise on Oct 22, 2026, through Oct 26, so timing can differ by enterprise or organization.

Choices you made yourself stay as they are.

Check your Claude mode: auto mode is becoming the default in most Claude apps. In an update dated Oct 22, 2026, Anthropic said it rolls out next week as the default for new sessions on Pro, Max and Team plans.

Instead of asking you to approve each action, an automated check lets safe actions go ahead and blocks risky ones while Claude looks for another route.

Google Cloud teams can soon buy OpenAI models right where they build. OpenAI said on Oct 21, 2026 that Codex agentic workflows are coming to Google Cloud’s Model Garden alongside the models, which will be sold through Google Cloud Marketplace.

General availability is planned in the coming weeks, and you can request access now.

Claude SDK users, check before you upgrade: the new major SDK and ant CLI versions released on Oct 21, 2026 send API version 2026-10-21 by default.

In that version, temperature, top_p or top_k in a request returns a 400 error, and so do document blocks placed directly in assistant messages. The new versions also move from the MIT License to Apache 2.0.

Read the full Main Course →

Claude Security now keeps scanning as your code changes. Announced on Oct 21, 2026: after a deep first scan, it scans new commits based on their risk, marks findings fixed when the fix lands and reopens them if the bug comes back.

It also adds an API, webhooks and an MCP connector. It’s in public beta for Claude Enterprise.

Pydantic AI users, update now: a High-severity fix stops crafted web pages from tying up your app. When web_fetch_tool fetched attacker-controlled HTML with many elements, converting it could delay unrelated work in the same process.

The maintainers published the fix on Oct 21, 2026: upgrade to 2.59.0, or 1.107.9 on v1.

PHP users, update now: two critical bugs can let an attacker run code on your server without logging in. PHP’s maintainers shipped the fixes on Oct 21, 2026 in 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

OpenAI says researchers at Calif found one of the flaws using GPT-5.6 Sol, and Wiz independently reported both.

Gemini CLI users, update now: settings in untrusted folders are now read-only. Before, gemini mcp add or gemini mcp remove in a folder you hadn’t trusted could remove all existing keys from that project’s .gemini/settings.json.

Claude Duet checks your apps and tells you what needs you. Anthropic’s new app sends a morning brief, takes on chores on its own cloud computer while you’re away, and asks before it sends, pays, signs or deletes anything. It’s a research preview by waitlist for Pro and Max subscribers.

Read the full Main Course →

Bedrock and Vertex users, update now: Claude Code’s failing requests are fixed. The previous release could fail every request on Vertex, Bedrock and other providers when the endpoint or a gateway rejected tool search. Claude Code now retries without it.

Pydantic AI users, update now: two Medium security fixes are out, one for MCP credentials that could reach OpenTelemetry traces and one for the Vercel AI and AG-UI adapters.

Upgrade to 2.58.0, or 1.107.8 on v1, then restrict access to old traces and rotate any credentials they exposed.

Action needed: six Copilot models were deprecated on Oct 19, 2026, including GPT-5.5, GPT-5.4 and Grok 4.5. Move workflows and integrations to the suggested alternatives, such as GPT-6.1 Sol, GPT-6 Luna, Gemini 3.8 Flash and Grok 4.7.

Set Copilot model rules with a script, not a settings page. GET and PATCH REST endpoints are now generally available to read and update Copilot model policies for enterprises, enterprise teams, enterprise apps and organizations.

Back to an old chat after a break? On Pro and Max plans, Claude Code now warns you when resuming an inactive conversation would use a noticeable share of your 5-hour usage limit.

Resume anyway, or start a new conversation and Claude can look up the previous one if you refer to it.

Check your model: the Cline provider’s default in Cline CLI and Desktop is Claude Sonnet 5.5 again. It’s back at the top of Cline’s recommended list. Also fixed: GPT-6 models now work on OpenAI and Azure OpenAI-compatible endpoints, where every request used to be rejected.

Action needed: move your design systems out of standalone Claude Design before Dec 14, 2026. That’s when claude.ai/design closes and starts sending you to Claude, where Claude Design now lives and new designs are created as artifacts.

Save any chats and comments you need first, because they don’t carry over.

Want long chats left alone while you’re away? A new Idle compaction row in /config turns that feature off or back on, and the notice after an idle compaction now says how.

Also changed: fork subagents are on by default in claude -p, the Agent SDK, the desktop app and VS Code, as they already were in the terminal.

Check your model: unpinned Cline provider setups now default to Gemini 4 Argon. OpenRouter stays on Claude Sonnet 5.5, but over 20 other providers change defaults too, so pin the model you want to keep.

Also new: Cloud sessions, rolling out gradually, run a job in a hosted sandbox on a GitHub repo and branch you pick and keep going after you close the editor.

Switch to a model with a smaller context window and Claude Code makes the chat fit. A conversation too long for the new model is now summarized by the previous model first, and a fix covers a case where that summary could spend usage credits without asking.

Unattended retry mode can now also give up on a usage limit that resets too far away.

Action needed: three Copilot models retire Nov 16, 2026. Claude Opus 4.8, Claude Opus 5 and GPT-5.6 Terra leave every Copilot experience. Move to Claude Opus 5.5 or GPT-6.1 Sol (or GPT-6 Luna) before your workflows find out the hard way. Individual annual plans keep Opus 4.8.

Copilot can now fix your security alerts and prove it. Assign a CodeQL alert and it patches the code, re-runs CodeQL to prove the alert is gone, then opens a draft PR. Up to 25 alerts per batch. Now GA.

Default-branch alerts only: an enterprise admin has to turn on the “Agentic autofix” policy, and each run spends Code Security AI Credits + Actions minutes. You can also start it via the REST API (copilot-swe-agent[bot]).

Ask about several repos at once without leaving Slack or Teams. Mention @GitHub to cover open PRs or issues across repos in one conversation. You can now mention it anywhere in your message, and in Slack it can read shared messages and threads as context.

Change your mind mid-answer and Codex listens. In the latest Codex CLI, send a follow-up while it’s still answering and it steers right away. New /config searches every setting, and independent read-only tools now run in parallel.

HydraFusion gets a bigger model pool and a Max tier. Its model pool now includes Claude Opus 5.5, GPT-6 Astra, GPT-6.1 Sol, and GPT-6 Luna. Cascade gets a judging step; Critique can tool-snoop the workspace with parallel critics. New HydraFusion Max is the “go deep” button.

Lives in VS Code, the Copilot app, and Copilot CLI.

Walk away from a long chat and Claude Code tidies it up. After ~54 idle minutes, a 200K+ token chat compacts before the prompt cache expires, so your next message doesn’t re-chew the whole transcript. Tune the threshold with CLAUDE_CODE_IDLE_COMPACT_MIN_TOKENS, or opt out with "idleCompaction": false.

Update now: Gemini CLI 0.64.0 carries folder trust into headless mode, so scripts and CI follow the same trust rules as a person at the keyboard. File tool writes are also atomic now, and saved state recovers from a backup if it gets corrupted.

Cursor’s Origin now plugs into the apps you already use. That’s 20+ apps: Cloudflare, Vercel, Buildkite, CircleCI, CodeRabbit, Greptile, Semgrep, Socket, Sentry, Linear, and friends. Public submissions welcome. Apps auth with app JWT + install tokens, get webhooks, write check runs / PR comments / reviews.

Copilot CLI Autopilot no longer stalls on a hook’s “ask” when nobody is watching.

• One more folder: /add-dir grants sandbox access for the session; interactive settings nudge you to mask likely secrets.
• No more stalled Autopilot: agent-scoped declarative hooks; Autopilot now denies a preToolUse hook’s “ask” instead of stopping on a permission dialog nobody is watching.
• New model, easier answers: Gemini 4 Argon support; /ask expands with Ctrl+E, copies with Ctrl+Y.

Check your model: unpinned Cline setups just got a new default. Cline + OpenRouter users now land on Claude Sonnet 5.5. About 20 other providers also shuffle defaults, so unpinned users will wake up on a different model. Pin the model you want to keep.

Action needed: OpenCode 2 is here, and updates are no longer automatic. opencode upgrade --major (or /update in the TUI) walks you there, so upgrade on purpose. It also allows OpenAI’s ultrafast service tier.

Give each subagent its own memory budget. The latest Claude Code release adds autoCompactWindow to subagent definitions, so a subagent can compact earlier than the main chat. A new variable runs every workflow agent on one model.

Run side tasks without the Git gymnastics. The new Codex CLI release can create and list managed Git worktrees from trusted local projects once the worktrees feature is on. It also lets you pin tasks in the agent Command Center with p.

A broken safety hook no longer waves the action through. The latest Claude Code release adds onFailure: "block" for command and HTTP hooks: a hook that can’t start, times out or exits with an unexpected code now blocks the action.

Check your model: Codex now defaults to GPT-6.1 Sol. The new Codex CLI release makes it the default in the bundled and Amazon Bedrock catalogs. You can also sign in to MCP servers from a session with /mcp login <name>.

Step away from your desk without losing track of your agents. The Cursor iOS app now shows the local agents running on your computer and lets you reply to them. It is on by default, except for Enterprise organizations.

Your deny rules stop slipping through side doors. The latest Claude Code release applies Bash deny and ask rules behind environment variable prefixes, holds them on nested parts of compound commands on managed machines, and applies Read deny rules to files reached through a symlink.

Action needed: four Copilot models are gone as of Oct 2, 2026. Suggested replacements: Gemini 3.8 Flash for Gemini 3.5 Flash and Gemini 3.6 Flash, Kimi K3 for Kimi K2.7 Code, and Claude Opus 5.5 for Claude Opus 4.7. Update workflows that name them.